90 matches found
php_mt_seed
phpmtseed phpmtseed 是一个 PHP mtrand 种子破解器。在最简单的调用模式下，它能在使用 mtsrand 播种后，仅凭首个 mtrand 输出值找出可能的种子。在高级调用模式下，它还能将多个、非首个和/或不精确的 mtrand 输出值与可能的种子值进行匹配。 PHP 的 mtrand 算法自 PHP 3.0.6 引入以来经历了多次变更。phpmtseed 4.0 支持该算法的 3 个主要修订版本：PHP 3.0.7 至 5.2.0、PHP 5.2.1 至 7.0.x，以及 PHP 7.1.0+（至少支持到撰写本文时的最新版本，即 PHP 7.2.0beta3）。...
CVE-2026-94107
NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substrmd5mtrand, 0, 10. Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative...
CVE-2026-94107 NivoCart through 2.4.0 Predictable Administrator Password Reset Token
NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substrmd5mtrand, 0, 10. Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative...
CVE-2026-14495: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because dologin\s::rrand seeds the Mersenne Twister with mtsranddouble microtime 1000000 — discarding the integer-second...
CVE-2025-68932: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators mtrand and uniqid to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to...
EUVD-2018-10212
Malware in sbrugna...
EUVD-2011-0767
Malware in sbrugna...
EUVD-2016-4748
Malware in sbrugna...
EUVD-2021-25611
Malware in sbrugna...
CVE-2021-39249
Invision Community aka IPS Community Suite or IP-Board before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through a brute-force attack against the PHP mtrand function...
CVE-2016-3735
Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmtrand in order to generate password reset tokens. mtrand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an...
GHSA-XG9W-R469-M455 ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities
In Zend Framework 2, the Zend\Math\Rand component generates random bytes using the OpenSSL or Mcrypt extensions when available but will otherwise use PHP's mtrand function as a fallback. All outputs from mtrand are predictable for the same PHP process if an attacker can brute force the seed used ...
ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities
In Zend Framework 2, the Zend\Math\Rand component generates random bytes using the OpenSSL or Mcrypt extensions when available but will otherwise use PHP's mtrand function as a fallback. All outputs from mtrand are predictable for the same PHP process if an attacker can brute force the seed used ...
Use of predictable RNG for password generation
Description pkp-lib implements a password-generation function with the following line of code being integral to its functionality: PHP for ... $password .= mtrand1, 4 == 4 ? $numbersmtrand0, strlen$numbers - 1 : $lettersmtrand0, strlen$letters - 1; This relies upon mtrandlow, high; to generate a...
SUSE CVE-2011-0755
Integer overflow in the mtrand function in PHP before 5.3.4 might make it easier for context-dependent attackers to predict the return values by leveraging a script's use of a large max parameter, as demonstrated by a value that exceeds mtgetrandmax...
Insecure Random Number Generator
phpservermon/phpservermon uses an insecure random number generator. The vulnerability exists because of the insecure mtrand random number generator function in the loginWithCookieData function of User.php, allowing an attacker to guess the strings it generates...
GHSA-382V-GXJ9-FFHC Moodle uses predictable password-recovery tokens
lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mtrand function to implement the randomstring and complexrandomstring functions, which makes it easier for remote attackers to predict password-recovery tokens via a...
CVE-2016-3735
Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmtrand in order to generate password reset tokens. mtrand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an...
CVE-2016-3735
Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmtrand in order to generate password reset tokens. mtrand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an...